An administrator is using tmsh to configure SSHD ACLs on a BIG-IP. The requirement is to allow SSH access from the 192.168.2.0/24 subnet and deny all other sources. What is the correct tmsh command sequence?

Create an allow rule for 192.168.2.0/24 first, then create a deny rule for 0.0.0.0/0.

Create only a deny rule for 0.0.0.0/0.

Create only an allow rule for 192.168.2.0/24.

Create a deny rule for 0.0.0.0/0 first, then create an allow rule for 192.168.2.0/24.

An administrator needs to configure SSHD ACLs to allow SSH access from the 10.0.0.0/8 subnet and the 172.16.0.0/12 subnet, but deny all other sources. What is the correct approach?

Create two allow rules (one for each subnet) and place them before a deny-all rule.

Create only the two allow rules and no deny-all rule.

Create a single allow rule that includes both subnets using a combined netmask.

Create a deny-all rule first, then create the two allow rules.

What is the effect of placing a 'deny all' rule before a 'permit specific IP' rule in an SSHD ACL?

All SSH connections will be denied, including the specific IP

Only the deny-all rule will be ignored

The rules will be reordered automatically to permit the specific IP

The specific IP will still be allowed because it is more specific

Which BIG-IP management service is directly governed by SSHD ACLs?

NTP client for time synchronization

How does the BIG-IP system determine which SSHD ACL rule applies to an incoming SSH connection?

All rules are evaluated and the most permissive one is applied

Rules are applied in random order to balance load

The most specific rule (longest netmask) always wins

The first rule in the list that matches the source address is applied

F5Certified Administrator, BIG-IP

Domain 1Objective 6

SSHD ACLs F5CAB1 Practice Questions (Page 3)

Part of the Securing BIG-IP domain, which makes up ~29% of our current practice bank. F5 does not publish an official question count, but from its 30-minute exam (~10–20 total, ~3–6 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

Questions 11–15

11application · medium
An administrator is using tmsh to configure SSHD ACLs on a BIG-IP. The requirement is to allow SSH access from the 192.168.2.0/24 subnet and deny all other sources. What is the correct tmsh command sequence?
Select an answer first
12application · medium
An administrator needs to configure SSHD ACLs to allow SSH access from the 10.0.0.0/8 subnet and the 172.16.0.0/12 subnet, but deny all other sources. What is the correct approach?
Select an answer first
13foundation · easy
What is the effect of placing a 'deny all' rule before a 'permit specific IP' rule in an SSHD ACL?
Select an answer first
14foundation · easy
Which BIG-IP management service is directly governed by SSHD ACLs?
Select an answer first
15foundation · easy
How does the BIG-IP system determine which SSHD ACL rule applies to an incoming SSH connection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to F5CAB1

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “F5CAB1” is a trademark of its owner, used for identification only.